The article discusses the rising threat of credential theft and sophisticated attacks that exploit weak identity verification processes. It emphasizes the importance of multi-factor authentication combining different factor categories, securing service desks against social engineering (including AI-enabled deepfakes), integrating device trust signals into access decisions, adopting passkeys based on FIDO2/WebAuthn standards to reduce reliance on passwords, and protecting biometric data by avoiding raw data storage and using encryption and local authentication. These practices collectively aim to mitigate risks of account takeover and unauthorized access in modern authentication workflows.

Credential theft surged by 160% in 2025, contributing to 20% of data breaches. Attackers bypass weak authentication through phishing, MFA fatigue, and social engineering, leading to account compromises and enabling further attacks such as ransomware and lateral movement. Service desk social engineering attacks have caused significant operational and financial impacts, exemplified by a five-day sales suspension at Marks and Spencers with daily losses of £3.8 million. Weak onboarding, static credentials, and inconsistent authentication policies increase exposure to these threats.

This guidance recommends adopting strong, phishing-resistant MFA methods such as FIDO2 security keys and authenticator apps generating local OTPs, moving away from vulnerable SMS/email OTPs. Organizations should secure service desks by embedding identity verification into workflows and using biometric liveness detection for high-risk actions. Incorporating device trust signals into authentication decisions helps differentiate legitimate from suspicious access attempts. Considering passkeys can reduce password reliance, but strong password policies remain necessary where passwords are fallback methods. Protect biometric data by storing encrypted templates and performing local authentication where possible. No specific patch or fix applies as this is best practice guidance rather than a software vulnerability.